The spec is not clear in this area and the Weld ServiceLoader implementation supports package-private extension classes. However we should follow the JDK's ServiceLoader implementation which does not allow package-private service provider classes.

See TCK tests:
org.jboss.jsr299.tck.tests.extensions.observer.broken.definitionError.ProcessObserverMethodErrorTest
org.jboss.jsr299.tck.tests.extensions.observer.broken.exception.ProcessObserverMethodExceptionTest